All Information Systems (IS) need an Authentication and Authorization (AA) System for security of their different modules. Existing Enterprise Systems, Frameworks and Portals use a similar centralized approach. In this paper, a new decentralized architecture has provided for AA in Modular Information Systems. To obtain this aim, firstly, all existing approaches and their disadvantages for AA, has been investigated and categorized. Secondly, to obtain a new architecture and solving disadvantages, new AA principles has been developed using robust object oriented principles and heuristics. New architecture has been developed based on these obtained AA principles. In addition, the new architecture decreases the Core complexity and distributes that into modules. Also the new architecture has maximum quality of reusability and extensibility and modifiability that can be applied to all Modular Information Systems. © 2011 IEEE.